前陣子搭建Hadoop時,配置了本機(localhost)的ssh的公開金鑰到authorized_keys檔案中,但是在ssh串連localhost時仍然提示需要輸入密碼,後來發現是$HOME/.ssh/authorized_keys這個檔案的許可權問題引起的。其原因是,不能讓所有者之外的使用者對authorized_keys檔案有寫入權限,否則,sshd將不允許使用該檔案,因為它可能會被其他使用者篡改。
命令列的示範如下:
[hadoop@guest1 ~]$ cd .ssh/[hadoop@guest1 .ssh]$ lltotal 16-rw-rw-r--1 hadoop hadoop 395 Jan 1218:37 authorized_keys-rw-------1 hadoop hadoop 1675 Jan 1218:36 id_rsa-rw-r--r--1 hadoop hadoop 395 Jan 1218:36 id_rsa.pub-rw-r--r--1 hadoop hadoop 796 Jan 6 08:40 known_hosts#注意這裡的authorized_keys檔案的許可權;這時該檔案中的key是不起作用的。#用chmod修改authorized_keys檔案的許可權[hadoop@guest1 .ssh]$ chmod g-w authorized_keys[hadoop@guest1 .ssh]$ lltotal 16-rw-r--r--1 hadoop hadoop 395 Jan 1218:37 authorized_keys-rw-------1 hadoop hadoop 1675 Jan 1218:36 id_rsa-rw-r--r--1 hadoop hadoop 395 Jan 1218:36 id_rsa.pub-rw-r--r--1 hadoop hadoop 796 Jan 6 08:40 known_hosts #修改後,sshd就可以正常使用authorized_keys檔案了[hadoop@guest1 ~]$ ssh localhostLast login: Sat Jan 1218:40:332013 from localhost[hadoop@guest1 ~]$ exitlogoutConnection to localhost closed.[hadoop@guest1 ~]$
後來,我詳細查了一下,如果authorized_keys檔案、$HOME/.ssh目錄 或 $HOME目錄讓本使用者之外的使用者有寫入權限,那麼sshd都會拒絕使用 ~/.ssh/authorized_keys 檔案中的key來進行認證的。
“man sshd”命令查看對authorized_keys檔案的描述如下:
man sshd..... ~/.ssh/authorized_keys Lists the public keys (DSA/ECDSA/RSA) that can be used for logging in as this user. The format of this file is described above. The content of the file is not highly sensitive, but the recommended permissions are read/write for the user, and not accessible by others. If this file, the ~/.ssh directory, or the user's home directory are writable by other users, then the file could be modified or replaced by unauthorized users. In this case, sshd will not allow it to be used unless the StrictModes option has been set to “no”.........